Release Notes

v1.0.10

Security

• Fixed CVE-2026-56851, CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031 and CVE-2026-97032 in the module images.

v1.0.9

Changes

• Kubelet eviction thresholds monitoring reworked. The eviction thresholds and the nodefs / imagefs statistics are now taken from the kubelet itself by a separate kubelet-eviction-thresholds-exporter Deployment in the d8-monitoring namespace instead of a node-exporter sidecar that inspected the node disks and the container runtime configuration. The monitoring uses the same data the kubelet uses to decide on eviction and works on any node OS, including Talos Linux. The kubelet_eviction_nodefs_* and kubelet_eviction_imagefs_* metrics are replaced by kubelet_eviction_threshold_percent and kubelet_eviction_resource_available_percent, the mountpoint label is no longer available, and the KubeletNodeFSBytesUsage, KubeletNodeFSInodesUsage, KubeletImageFSBytesUsage and KubeletImageFSInodesUsage alerts are rebuilt on the new metrics. Custom dashboards and alerts based on the old metrics need to be updated; the migration table is in the module documentation. Nodes with enableDebuggingHandlers disabled on the kubelet expose no eviction metrics

Bug fixes

• Fixed a crash of node-exporter on nodes where the textfile collector directory contained the same metric with inconsistent HELP texts in some files and without HELP in others, and a file descriptor leak in the zfs collector on nodes with the ZFS module loaded

v1.0.8

Enhancements

• Added the Node group selector to the Node, Nodes, Nodes ping, Capacity Planning, Namespace, Namespaces and Namespace / Controller dashboards. The Node selector now lists only the nodes of the selected node groups. The Count panel on the Nodes dashboard is no longer capped at 100 nodes

v1.0.7

Security

• Fixed CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84304, CVE-2026-84445 and CVE-2026-81870 in the node-exporter and kube-state-metrics images

v1.0.6

Features

• Added SecurityPolicyException resources for node-exporter and oom-kills-exporter, so the exporters keep working in clusters with security policies enforced by the admission-policy-engine module

Changes

• Added the d8_source="dkp" label to the metrics and recording rules shipped with the module, so metrics produced by the platform can be told apart from the user ones

Bug fixes

• Fixed PVC panels on the Controller, Namespace and Pod dashboards: the panels now respect the selected PVC and show the data broken down by pod
• Fixed the Receive / Transmit network panels on the Controller dashboard for pods running with hostNetwork: true
• Fixed the troubleshooting command in the LoadBalancerServiceWithoutExternalIP alert description: it now also takes the load balancer hostname into account, not only the IP address

v1.0.5

Security

• Fixed various vulnerabilities in third-party libraries and bundled base images. Non-exploitable CVEs are addressed via VEX statements

v1.0.4

Bug fixes

• Fixed the registry secret generation for modules installed from a custom ModuleSource

v1.0.3

Changes

• Removed the StorageClassCloudManual alert and the hook that detected manually created StorageClasses

Bug fixes

• Fixed the relabeling regular expression for the OOM kills metrics collected by ebpf-exporter

v1.0.2

Changes

• Added the new VPA update modes (InPlaceOrRecreate, InPlaceOnly) to the kube_verticalpodautoscaler_spec_updatepolicy_updatemode metric produced by kube-state-metrics

v1.0.1

Changes

• The module is now enabled by default in the Default and Managed bundles

v1.0.0

Changes

• The monitoring-kubernetes module is now shipped as a separate Deckhouse module instead of being a part of the Deckhouse Kubernetes Platform core
• Module lifecycle stage is set to General Availability